diff options
| author | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-20 17:29:46 -0600 |
|---|---|---|
| committer | Brett Weiland <brett_weiland@bpcspace.com> | 2020-12-20 17:29:46 -0600 |
| commit | 5660ef31669a5917d67b227d37e36e7887a839b0 (patch) | |
| tree | 00f0a87b0aa9c315bdb1132d6fcb62ebc1939853 /x86_64/ret2csu/gadgets | |
| parent | 11cbb37694aab501681435375679c49989cdfc91 (diff) | |
modified: x86_64/ret2csu/gadgets
Diffstat (limited to 'x86_64/ret2csu/gadgets')
| -rw-r--r-- | x86_64/ret2csu/gadgets | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets index 87a3bb8..f3adc78 100644 --- a/x86_64/ret2csu/gadgets +++ b/x86_64/ret2csu/gadgets @@ -71,16 +71,18 @@ Disassembly of section .fini: calling x86: controlling rdx: -1: 0x00000000004006a3 - rdi : 0xdeadbeefdeadbeef 2: 0x40069a rbx: 0 <-- - rbp: whatever - r12: 0x601020 <-- next location. lets try to make it ret2win - r13: 0xdeadbeef <-- would be nice if we could use a 64 bit value + rbp: 1 + r12: 0xffffffff <-- next location. lets try to make it + r13: whatever I guess <-- would be nice if we could use a 64 bit value r14: 0xcafebabecafebabe r15: 0xd00df00dd00df00d <-- +we can set r12 to [function@plt], and rbx to desired offset. -3: 0x0000000000400510 (ret2win) +0x00000000004004e0 : call rax + +target address: 0x00000000004006a3 +0000000000400510 ret2csu |